AZ-500 Manage identity and access Practice Question
A company uses Microsoft Defender for Cloud's Just-In-Time (JIT) VM access to manage RDP connections to a critical jump-box virtual machine. The company has a CI/CD pipeline running on Azure DevOps agent pools that needs to periodically RDP into this VM to deploy software. The agent pool's source IP addresses are dynamic and change frequently. They want the pipeline to automatically request JIT access before each deployment without manual intervention. Which approach should they implement?
⚠ Common exam trap
Many candidates think scheduled JIT rules (Option B) exist or that permanently whitelisting an IP (Option D) is acceptable, but Azure JIT is designed for dynamic, on-demand access requests, not static schedules or permanent allowances.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the Azure REST API with a managed identity assigned to the DevOps agent to request JIT access, specifying the agent's current source IP address
It uses the Azure REST API with a managed identity to dynamically request JIT VM access, specifying the agent's current source IP address. This approach allows the CI/CD pipeline to authenticate without secrets and automatically obtain time-bound RDP access, even though the agent's IP changes frequently. The managed identity provides secure, automated authentication to Azure Resource Manager, enabling the pipeline to call the JIT policy endpoint and grant access for the deployment duration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use the Azure REST API with a managed identity assigned to the DevOps agent to request JIT access, specifying the agent's current source IP address
Why this is correct
The REST API endpoint for JIT allows programmatic requests. A managed identity on the agent (or virtual machine running the agent) provides secure authentication without secrets. The pipeline can fetch its current outbound IP and request JIT access for the required time.
- ✗
Create a JIT access rule in Defender for Cloud with a scheduled time window that matches the pipeline's deployment schedule
Why it's wrong here
Scheduling a JIT rule to open the port during expected times undermines the zero-trust principle of JIT. It leaves the port open for the entire window, even if no deployment occurs, increasing the attack surface.
- ✗
Configure a PowerShell script in the pipeline to modify the network security group (NSG) to allow the agent's IP during deployment
Why it's wrong here
Directly modifying the network security group (NSG) via PowerShell from a pipeline bypasses Defender for Cloud's JIT control plane, so the access is neither recorded in the JIT audit log nor bounded by an expiration time. This approach also risks leaving the allow rule stale if the script fails or the agent IP changes, and it duplicates JIT's functionality instead of using the intended REST API with a managed identity. The JIT API atomically creates and later removes the rule, ensuring the port is open only for the requested interval and fully visible to security monitoring.
- ✗
Assign a static public IP to the Azure DevOps agent and add that IP to the JIT allowed list permanently
Why it's wrong here
Adding the DevOps agent's static public IP to the JIT allowed list permanently is effectively pre-authorizing that IP for all times, which negates the central purpose of just-in-time access — limiting exposure to a narrow, approved time window. Unlike a transient JIT rule, a permanent entry leaves the management port open even when no pipeline deployment is running, and it remains exploitable if the agent is compromised. JIT rules should be requested on-demand via the REST API with the agent's current source IP, letting Defender for Cloud grant access only for the duration of the deployment.
Go deeper
Related to this question
About these practice questions
One of 194 original AZ-500 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.